Method for Parsing Network Message and Communication Device

• US 20140280924A1
• Filed: 05/30/2014
• Published: 09/18/2014
• Est. Priority Date: 11/30/2011
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Hasson, Uri, Kristal, Amit, Mo, Mo, Huang, Jian
• Granted Patent: US 9,819,719 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 51/18 Commands or executable codes
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A method for parsing a network message and a communication device are provided. The method includes: receiving a network message, where the network message includes one or more sections; identifying that an application protocol type of the network message is a first application protocol; acquiring, from a current section that is in the network message and that is described by a piece of section description information in a configuration file corresponding to the first application protocol, interesting data indicated by interesting data indication information in the section description information; and executing a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition, thereby obtaining a corresponding decision result, when the current section is a last section of the network message, the decision result includes a processing method of a next message of the network message.

Claims

1. A method for parsing a network message, comprising:

receiving a network message, wherein the network message comprises one or more sections;

identifying that an application protocol type of the network message is a first application protocol;

acquiring, from a current section that is in the network message and that is described by a piece of section description information in a configuration file corresponding to the first application protocol, interesting data indicated by interesting data indication information in the section description information; and

executing a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition, thereby obtaining a corresponding decision result,

wherein when the current section is a last section of the network message, the decision result comprises a processing method of a next message of the network message, and

wherein both the network message and the next message belong to a same application layer.

2. The method according to claim 1, wherein the interesting data indication information is a header field name and the interesting data indicated by the interesting data indication information is a header field value located behind a corresponding header field, wherein the interesting data indication information is the header field name and the interesting data indicated by the interesting data indication information is interesting data indicated by the corresponding header field name, wherein the interesting data indication information is an attribute name and the interesting data indicated by the interesting data indication information is an attribute value, or wherein the interesting data indication information is a label name and the interesting data indicated by the interesting data indication information is a label value.

3. The method according to claim 1, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, and wherein the decision result comprises a parameter required by execution of the atomic method and one or more of the following atomic methods:

setting a next section, changing a protocol type of a first section of the next message, setting a protocol type of the next section, and setting a decoding algorithm that needs to be performed before the next section is to be processed.

4. The method according to claim 1, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, wherein when the interesting data indication information comprises first indication information that indicates protocol type information of a next section and second indication information that indicates length information of the next section, the acquired interesting data comprises the protocol type information and the length information, and wherein when the protocol type information and the length information are used as the decision condition and the length information indicates that the current section is the last section, the corresponding decision result comprises an atomic method of changing a protocol type of a first section of the next message and wherein the protocol type of the first section of the next message is a protocol type indicated by the protocol type information.

5. The method according to claim 1, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, wherein when the interesting data indication information comprises first indication information that indicates protocol type information of the next section, the acquired interesting data comprises the protocol type information, when the protocol type information is used as the decision condition, the corresponding decision result comprises an atomic method of changing a protocol type of a first section of the next message, and wherein the protocol type of the first section of the next message is a protocol type indicated by the protocol type information.

6. The method according to claim 1, wherein when the current section is not the last section of the network message, the decision result indicates a processing method of a next section of the current section.

7. The method according to claim 6, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, wherein when the interesting data indication information comprises first indication information that indicates protocol type information of the next section, the acquired interesting data comprises the protocol type information, and wherein when the protocol type information is used as the decision condition, the corresponding decision result comprises an atomic method of setting a protocol type of the next section and wherein the protocol type of the next section is a protocol type indicated by the protocol type information.

8. The method according to claim 6, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, wherein when the interesting data indication information comprises second indication information that indicates length information of the next section, the acquired interesting data comprises the length information, and wherein when the length information is used as the decision condition, the corresponding decision result comprises an atomic method of setting the next section as a section with a preset length directly skipped and wherein the preset length is a length indicated by the length information.

9. The method according to claim 6, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, wherein when the interesting data indication information comprises third indication information that indicates encoding and decoding information of the next section, the acquired interesting data comprises the encoding and decoding information, and wherein when the encoding and decoding information is used as the decision condition, the corresponding decision result comprises an atomic method of setting a decoding algorithm that needs to be performed before the next section is to be parsed and wherein the decoding algorithm that needs to be performed before the next section is to be processed is a decoding algorithm indicated by the encoding and decoding information.

10. The method according to claim 1, wherein the section description information comprises a section name, a section type, the interesting data indication information, and the decision method, wherein the section type indicates a scanning method used by the current section, wherein acquiring interesting data indicated by interesting data indication information in the section description information comprises:

obtaining the interesting data indication information by scanning the current section corresponding to the section name by using the scanning method indicated by the section type; and

acquiring the interesting data indicated by the interesting data indication information.

11. The method according to claim 10, wherein the section type indicates a fast scanning method, and wherein obtaining the interesting data indication information by scanning the current section corresponding to the section name by using the scanning method indicated by the section type comprises:

skipping characters of a specific length from a first character of the current section corresponding to the section name;

when a skipped-to character is a data delimiter, determining whether n characters, which are not data delimiters and which are behind the skipped-to character and closest to the skipped-to character, are the first n characters in the interesting data indication information, and when it is determined that the n characters are the first n characters in the interesting data indication information;

obtaining, by matching, the interesting data indication information from the current section according to the first n characters in the interesting data indication information, wherein n is greater than or equal to 1;

when the skipped-to character is a character in the first n characters in the interesting data indication information, determining whether a character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is a data delimiter; and

when it is determined that the character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is a data delimiter, obtaining, by matching, the interesting data indication information from the current section by using the skipped-to character.

12. A communication device, comprising:

a communications module configured to receive a network message, wherein the network message comprises one or more sections;

an identification module configured to identify that an application protocol type of the network message is a first application protocol; and

a parsing module configured to;

acquire, from a current section that is in the network message and that is described by a piece of section description information in a configuration file corresponding to the first application protocol, interesting data indicated by interesting data indication information in the section description information; and

execute a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition, thereby obtaining a corresponding decision result, wherein when the current section is a last section of the network message, the decision result comprises a processing method of a next message of the network message and both the network message and the next message belong to a same application layer.

13. The communication device according to claim 12, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, and wherein the parsing module comprises:

a parsing submodule configured to acquire, from the current section that is in the network message and that is described by the section description information in the configuration file corresponding to the first application protocol, the interesting data indicated by the interesting data indication information in the section description information, wherein the interesting data indication information comprises first indication information that indicates protocol type information of a next section and second indication information that indicates length information of the next section, and wherein the acquired interesting data comprises the protocol type information and the length information; and

a decision submodule configured to obtain, by decision, the corresponding decision result by using the protocol type information and the length information as the decision condition, wherein the length information indicates that the current section is the last section, wherein the decision result comprises an atomic method of changing a protocol type of a first section of the next message, wherein the protocol type of the first section of the next message is a protocol type indicated by the protocol type information.

14. The communication device according to claim 12, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, and wherein the parsing module comprises:

a parsing submodule configured to acquire, from the current section that is in the network message and that is described by the section description information in the configuration file corresponding to the first application protocol, the interesting data indicated by the interesting data indication information in the section description information, wherein the interesting data indication information comprises first indication information that indicates protocol type information of a next section, and wherein the acquired interesting data comprises the protocol type information; and

a decision submodule configured to obtain, by decision, the corresponding decision result by using the protocol type information as the decision condition, wherein the decision result comprises an atomic method of changing a protocol type of a first section of the next message, and wherein the protocol type of the first section of the next message is a protocol type indicated by the protocol type information.

15. The communication device according to claim 12, wherein when the current section is not the last section of the network message, the decision result, which is obtained by the parsing module, indicates a processing method of a next section of the current section.

16. The communication device according to claim 15, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, and wherein the parsing module comprises:

a parsing submodule configured to acquire, from the current section that is in the network message and that is described by the section description information in the configuration file corresponding to the first application protocol, the interesting data indicated by the interesting data indication information in the section description information, wherein the interesting data indication information comprises;

first indication information that indicates protocol type information of a next section, and wherein the acquired interesting data comprises the protocol type information; and

a decision submodule configured to obtain, by decision, the corresponding decision result by using the protocol type information as the decision condition, wherein the decision result comprises an atomic method of setting a protocol type of the next section, and wherein the protocol type of the next section is a protocol type indicated by the protocol type information.

17. The communication device according to claim 15, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, and wherein the parsing module comprises:

a parsing submodule configured to acquire, from the current section that is in the network message and that is described by the section description information in the configuration file corresponding to the first application protocol, the interesting data indicated by the interesting data indication information in the section description information, wherein the interesting data indication information comprises second indication information that indicates length information of the next section, and wherein the acquired interesting data comprises the length information; and

a decision submodule configured to obtain, by decision, the corresponding decision result by using the length information as the decision condition, wherein the decision result comprises an atomic method of setting the next section as a section with a preset length directly skipped, and wherein the preset length is a length indicated by the length information.

18. The communication device according to claim 15, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, wherein the parsing module comprises:

a parsing submodule configured to acquire, from the current section that is in the network message and that is described by the section description information in the configuration file corresponding to the first application protocol, the interesting data indicated by the interesting data indication information in the section description information, wherein the interesting data indication information comprises third indication information that indicates encoding and decoding information of the next section, and wherein the acquired interesting data comprises the encoding and decoding information; and

a decision submodule configured to obtain, by decision, the corresponding decision result by using the encoding and decoding information as the decision condition, wherein the decision result comprises an atomic method of setting a decoding algorithm that needs to be performed before the next section is to be processed, and wherein the decoding algorithm that needs to be performed before the next section is to be processed is a decoding algorithm indicated by the encoding and decoding information.

19. The communication device according to claim 12, wherein the section description information comprises a section name, a section type, the interesting data indication information, and the decision method, and wherein the section type indicates a scanning method used by the current section, wherein the parsing module comprises:

a scanning submodule configured to obtain the interesting data indication information by scanning the current section corresponding to the section name by using the scanning method indicated by the section type;

an acquiring submodule configured to acquire the interesting data that is indicated by the interesting data indication information obtained by scanning; and

a decision submodule configured to execute the decision method in the section description information by using all or a part of the interesting data, thereby obtaining the corresponding decision result.

20. The communication device according to claim 19, wherein the scanning submodule comprises:

a fast scanning submodule configured to;

skip characters of a specific length from a first character of the current section corresponding to the section name;

when a skipped-to character is a data delimiter, determine whether n characters, which are not data delimiters and which are behind the skipped-to character and closest to the skipped-to character, are first n characters in the interesting data indication information, wherein n is greater than or equal to 1; and

when the skipped-to character is a character in the interesting data indication information, determine whether a character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is a data delimiter; and

a precise matching submodule configured to;

when it is determined that the n characters, which are not data delimiters and which are behind the skipped-to character and closest to the skipped-to character, are the first n characters in the interesting data indication information, obtain, by matching, the interesting data indication information in the current section according to the first n characters in the interesting data indication information; and

when it is determined that the character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is the data delimiter, obtain, by matching, the interesting data indication information from the current section by using the skipped-to character.

21. The communication device according to claim 12, wherein the communication device further comprises:

a policy matching module configured to determine a pre-defined policy applicable to the network message by using the interesting data; and

a policy execution module configured to perform, by using the pre-defined policy, an operation on a data flow where the network message is located.

22. A parsing system, comprising:

a processing engine; and

a compiling engine configured to compile a configuration file into protocol parsing auxiliary data that can be identified by the processing engine, wherein different application protocol types correspond to different configuration files,

wherein the processing engine is configured to;

receive a network message comprising one or more sections;

identify that an application protocol type of the network message is a first application protocol;

acquire, from a current section that is in the network message and that is described by a piece of section description information in protocol parsing auxiliary data corresponding to the first application protocol, interesting data indicated by interesting data indication information in the section description information; and

execute a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition, thereby obtaining a corresponding decision result, wherein when the current section is a last section of the network message, the decision result comprises a processing method of a next message of the network message and both the network message and the next message belong to a same application layer.

23. The system according to claim 22, wherein the configuration file corresponding to the application protocol type comprises one or more pieces of section description information, wherein the section description information comprises a section name, a section type, the interesting data indication information, and the decision method, and the section type indicates a scanning method used by a section, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, wherein the decision result comprises a parameter required by execution of the atomic method and one or more of the following atomic methods:

setting a next section, changing a protocol type of a first section of the next message, setting a protocol type of the next section, and setting a decoding algorithm that needs to be performed before the next section is to be processed.

24. The system according to claim 22, further comprising a memory manager configured to manage a memory used by the compiling engine and processing engine, wherein the compiling engine and the processing engine use different memory areas of the memory are used by the compiling engine and the processing engine respectively.

25. The system according to claim 22, further comprising:

a loader configured to read the configuration file from an internal storage device or external storage device and load the configuration file into the compiling engine.

26. The system according to claim 22, wherein the compiling engine comprises:

a fast scanning compiler configured to;

compile interesting data indication information in each section described in the configuration file into machine-readable protocol parsing auxiliary data; and

output a fast scanning table, wherein the fast scanning table comprises first n characters of the interesting data indication information and protocol parsing auxiliary data corresponding to a data delimiter in the section;

a precise matching compiler configured to compile a multi-mode matching algorithm into machine-readable protocol parsing auxiliary data; and

a logical decision compiler configured to compile the decision method in the configuration file into machine-readable protocol parsing auxiliary data.

27. The system according to claim 26, wherein the processing engine comprises:

a fast scanning module configured to;

skip characters of a specific length from a first character of the current section corresponding to the section name;

determine whether a skipped-to character is a data delimiter or a character in the first n characters in the interesting data indication information according to the fast scanning table;

when the skipped-to character is the data delimiter, determine whether n characters, which are not data delimiters and which are behind the skipped-to character and closest to the skipped-to character, are the first n characters in the interesting data indication information; and

when the skipped-to character is the character in the first n characters in the interesting data indication information, determine whether a character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is a data delimiter, wherein n is greater than or equal to 1;

a precise matching module configured to;

when it is determined that the n characters, which are not data delimiters and which are behind the skipped-to character and closest to the skipped-to character, are the first n characters in the interesting data indication information, execute the compiled multi-mode matching algorithm in the protocol parsing auxiliary data according to the first n characters in the interesting data indication information, so as to obtain, by matching, the interesting data indication information in the current section; and

when it is determined that the character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is the data delimiter, execute the compiled multi-mode matching algorithm in the protocol parsing auxiliary data by using the skipped-to character, so as to obtain, by matching, the interesting data indication information in the current section; and

a decision maker configured to;

acquire, according to the interesting data indication information obtained by matching, the interesting data indicated by the interesting data indication information, and

execute the decision method in the compiled section description information in the protocol parsing auxiliary data by using all or a part of the interesting data, thereby obtaining a decision result.

28. The system according to claim 22, wherein the processing engine further comprises an output module configured to output the acquired interesting data to outside.

29. A computer system, comprising:

an interface;

a memory; and

a processor connected to the memory and configured to;

obtain a network message which is received from the interface, wherein the network message comprises one or more sections;

identify that an application protocol type of the network message is a first application protocol;

acquire, from a current section that is in the network message and that is described by a piece of section description information in a configuration file corresponding to the first application protocol, interesting data indicated by interesting data indication information in the section description information; and

execute a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition, thereby obtaining a corresponding decision result,

wherein when the current section is a last section of the network message, the decision result comprises a processing method of a next message of the network message and both the network message and the next message belong to a same application layer.

30. The computer system according to claim 29, wherein the interesting data indication information is a header field name and the interesting data indicated by the interesting data indication information is a header field value located behind a corresponding header field, wherein the interesting data indication information is a header field name and the interesting data indicated by the interesting data indication information is interesting data indicated by the corresponding header field name, wherein the interesting data indication information is an attribute name and the interesting data indicated by the interesting data indication information is an attribute value, or wherein the interesting data indication information is a label name and the interesting data indicated by the interesting data indication information is a label value.

31. The computer system according to claim 29, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, and wherein in acquiring interesting data indicated by interesting data indication information in the section description information and executing a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition, the processor is further configured to:

acquire, from the current section that is in the network message and that is described by the section description information in the configuration file corresponding to the first application protocol, the interesting data indicated by the interesting data indication information in the section description information, wherein the interesting data indication information comprises first indication information that indicates protocol type information of a next section and second indication information that indicates length information of the next section, and wherein the acquired interesting data comprises the protocol type information and the length information; and

obtain, by decision, the corresponding decision result by using the protocol type information and the length information as the decision condition, wherein the length information indicates that the current section is the last section, wherein the decision result comprises an atomic method of changing a protocol type of a first section of the next message, and wherein the protocol type of the first section of the next message is a protocol type indicated by the protocol type information.

32. The computer system according to claim 29, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, and wherein in acquiring interesting data indicated by interesting data indication information in the section description information and executing a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition, the processor is further configured to:

acquire, from the current section that is in the network message and that is described by the section description information in the configuration file corresponding to the first application protocol, the interesting data indicated by the interesting data indication information in the section description information, wherein the interesting data indication information comprises first indication information that indicates protocol type information of a next section, and wherein the acquired interesting data comprises the protocol type information; and

obtain, by decision, the corresponding decision result by using the protocol type information as the decision condition, wherein the decision result comprises an atomic method of changing a protocol type of a first section of the next message, and wherein the protocol type of the first section of the next message is a protocol type indicated by the protocol type information.

33. The computer system according to claim 29, wherein when the current section is not the last section of the network message, and wherein the decision result indicates a processing method of a next section of the current section.

34. The computer system according to claim 33, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, and wherein the decision condition comprises one or more pieces of interesting data, wherein in acquiring interesting data indicated by interesting data indication information in the section description information and executing a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition, the processor is further configured to:

acquire, from the current section that is in the network message and that is described by the section description information in the configuration file corresponding to the first application protocol, the interesting data indicated by the interesting data indication information in the section description information, wherein the interesting data indication information comprises first indication information that indicates protocol type information of a next section, and wherein the acquired interesting data comprises the protocol type information; and

obtain, by decision, the corresponding decision result by using the protocol type information as the decision condition, wherein the decision result comprises an atomic method of setting a protocol type of the next section, and wherein the protocol type of the next section is a protocol type indicated by the protocol type information.

35. The computer system according to claim 33, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, wherein the decision condition comprises one or more pieces of interesting data, wherein in acquiring interesting data indicated by interesting data indication information in the section description information and executing a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition, the processor is further configured to:

acquire, from the current section that is in the network message and that is described by the section description information in the configuration file corresponding to the first application protocol, the interesting data indicated by the interesting data indication information in the section description information, wherein the interesting data indication information comprises second indication information that indicates length information of the next section, and wherein the acquired interesting data comprises the length information; and

obtain, by decision, the corresponding decision result by using the length information as the decision condition, wherein the decision result comprises;

an atomic method of setting the next section as a section with a preset length directly skipped, and wherein the preset length is a length indicated by the length information.

36. The computer system according to claim 33, wherein the decision method indicates that different atomic methods are executed according to different decision conditions, and wherein the decision condition comprises one or more pieces of interesting data, wherein in acquiring interesting data indicated by interesting data indication information in the section description information and executing a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition the processor is further configured to:

acquire, from the current section that is in the network message and that is described by the section description information in the configuration file corresponding to the first application protocol, the interesting data indicated by the interesting data indication information in the section description information, wherein the interesting data indication information comprises third indication information that indicates encoding and decoding information of the next section, and wherein the acquired interesting data comprises the encoding and decoding information; and

obtain, by decision, the corresponding decision result by using the encoding and decoding information as the decision condition, wherein the decision result comprises an atomic method of setting a decoding algorithm that needs to be performed before the next section is to be processed, and wherein the decoding algorithm that needs to be performed before the next section is to be processed is a decoding algorithm indicated by the encoding and decoding information.

37. The computer system according to claim 29, wherein the section description information comprises a section name, a section type, the interesting data indication information, and the decision method, wherein the section type indicates a scanning method used by the current section, wherein in acquiring interesting data indicated by interesting data indication information in the section description information, the processor is further configured to:

obtain the interesting data indication information by scanning the current section corresponding to the section name by using the scanning method indicated by the section type; and

acquire the interesting data indicated by the interesting data indication information.

38. The computer system according to claim 37, wherein the section type indicates a fast scanning method, and wherein in obtaining the interesting data indication information by scanning the current section corresponding to the section name by using the scanning method indicated by the section type, the processor is further configured to:

skip characters of a specific length from a first character of the current section corresponding to the section name;

when a skipped-to character is a data delimiter, determine whether n characters, which are not data delimiters and which are behind the skipped-to character and closest to the skipped-to character, are first n characters in the interesting data indication information; and

when it is determined that the n characters, which are not data delimiters and which are behind the skipped-to character and closest to the skipped-to character, are first n characters in the interesting data indication information, obtain, by matching, the interesting data indication information from the current section according to the first n characters in the interesting data indication information, wherein n is greater than or equal to 1;

when the skipped-to character is a character in the first n characters in the interesting data indication information, determine whether a character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is a data delimiter; and

when it is determined that the character, which is not in the interesting data indication information and which is before the skipped-to character and closest to the skipped-to character, is a data delimiter, obtain, by matching, the interesting data indication information from the current section by using the skipped-to character.